// case comparison
romance scam vs sextortion
victim reports online relationship turning into money demand. case A is romance-scam: dating-app grooming ending in Venmo, Cash App, or wire — often without intimate-image ultimatum. case B is sextortion: payment demand tied to release of real, scraped, or deepfake intimate imagery. wrong call sends you to ios-dating-app-artifact-forensic-extractor when you need ai-generated-image-provenance-analyzer on threat imagery — or treats a sextortion crypto wallet as a romance wire without analyzing the ultimatum channel.
primary tools · side by side
ordered entry points from the case-type taxonomy. highlighted rows appear in both case types' editorial tool lists.
romance scam
dating-app introduction → emotional manipulation → money request. evidence is profile screenshots, message archives, payment trails.
- 01ios dating app artifact forensic extractor (Tinder, Bumble, Hinge)drop iOS dating app database files (Tinder, Bumble, or Hinge) · auto-detect app · parse match records, messages, and profile metadata · surface match timestamps, screenshot alerts, and own location from account plist · detect confirmed real-world meetings (Hinge We Met) · runs locally
- 02iOS WhatsApp artifact forensic extractordrop iOS WhatsApp ChatStorage.sqlite and Contacts.sqlite · parse all chats, messages, groups, and media references · reconstruct conversation timelines with delivery status · surface location shares, contact cards, and deleted message placeholders · runs locally
- 03android whatsapp database forensic analyzerdrop an Android WhatsApp msgstore.db · parse all messages, chats, groups, and media metadata · reconstruct conversation timelines · surface message delivery status, forwarding metadata, location shares, and contact cards · detect deleted message gaps · runs locally
- 04ios telegram artifact forensic extractordrop cache4.db or account db · parse chats messages channels · forwarding edits tombstones · disappearing timers · mid gap analysis · runs locally
- 05android telegram database forensic extractordrop Android Telegram database files · parse messages, chats, channels, and contacts · extract forwarding metadata, edit timestamps, and media references · surface disappearing message timer settings · detect deleted message ROWID gaps · reconstruct Telegram communication timeline · runs locally
- 06ios cash app artifact forensic extractordrop iOS Cash App database files from the app container · parse transaction records, payment notes, and account artifacts · surface payment amounts, counterparty Cashtags, and timestamps · detect suspicious payment patterns and structured transactions · runs locally
- 07ios venmo artifact forensic extractordrop iOS Venmo database files from the app container · parse payment records and transaction notes · surface audience settings (public/friends/private) · surface social feed likes and comments on transactions · reconstruct Venmo financial and social activity timeline · runs locally
- 08ai generated image provenance analyzerpng tEXt chunk inventory · sd metadata · stripped metadata flag · provenance csv · runs locally
sextortion
extortion via real/fake intimate imagery. evidence is the threat channel + payment demand + (often) deepfake or scraped imagery.
- 01email header analyzerpaste raw email headers · trace hop-by-hop routing · SPF · DKIM · DMARC · detect spoofing · visualize delivery path · runs locally
- 02ios imessage deletion artifact detectordrop ios sms.db · rowid gaps · join orphans · deleted_messages tombstones · ck_sync_state=2 · two-db guid compare · bulk deletion · runs locally
- 03iOS WhatsApp artifact forensic extractordrop iOS WhatsApp ChatStorage.sqlite and Contacts.sqlite · parse all chats, messages, groups, and media references · reconstruct conversation timelines with delivery status · surface location shares, contact cards, and deleted message placeholders · runs locally
- 04android whatsapp database forensic analyzerdrop an Android WhatsApp msgstore.db · parse all messages, chats, groups, and media metadata · reconstruct conversation timelines · surface message delivery status, forwarding metadata, location shares, and contact cards · detect deleted message gaps · runs locally
- 05ai generated image provenance analyzerpng tEXt chunk inventory · sd metadata · stripped metadata flag · provenance csv · runs locally
- 06face swap artifact detectordrop an image · jawline color mismatch · compression boundary heuristics · face-region signal table · runs locally
- 07bitcoin transaction decoderpaste raw transaction hex · decode inputs outputs scripts · fees · locktime · segwit · p2pkh p2sh p2wpkh · runs locally
- 08crypto tx graphpaste json csv btc hex · directed graph · hub peel fan patterns · ascii viz · stats · csv json export · runs locally
editorial overlap
8 tools mapped to both case types in the editorial taxonomy — useful when the investigation spans both surfaces.
lean toward…
disambiguation signals derived from case-type descriptions and common practitioner confusion points.
lean toward romance scam if you see…
- Venmo, Cash App, or wire transfer request after dating-app chat grooming — no pay-or-publish intimate-image ultimatum
- shorter arc: emergency funds, travel money, or gift cards — not deepfake intimate imagery threat
- payment trail in mobile P2P apps — not bitcoin demand tied explicitly to image release
lean toward sextortion if you see…
- explicit pay-or-publish ultimatum tied to intimate imagery on dedicated extortion channel
- deepfake or scraped intimate imagery with crypto or gift-card payment demand
- threat centers image release — not emergency wire request from romance script alone